Re: [Rift] Initial implementation of security in RIFT-Python is complete

Ok, I looked over the stuff in more detail again and I see that the yaml
schema is only a limited security model and would hence like to extend it a
bit. Let me know what you think

At the top I'd like to add private-secret to support private/public key and
not only shared

{?} keys:
    {+} - id: <24-bit key number>
    {1}   algorithm: [hmac-sha-256]
    {1}   secret: <string>
    {?}   private-secret: <string>

*under -name (i.e. per node) it would be good to have *

{?}      tie_validation: [none|permissive|loose|strict]

to support testing of the common models of processing of signatures

Then under interface we'd need

{?}           active_key: <8-bit key number>
{?}           accept_keys: <set of 8-bit key number>
{?}           lie_validation: [none|permissive|loose|strict]  (6)

so we can test mix of interfaces using different keys and not using them ta
all (we can share the global keys for that purpose since it's simpler but
can only use the 8-bit IDs)

--- tony

On Wed, Apr 24, 2019 at 10:47 AM Antoni Przygienda <prz=
40juniper.net@dmarc.ietf.org> wrote:

> read your guide in detail. makes all perfect sense. will extend schema to
> what you suggest so inter'op ...
>
> thanks
>
> --- tony
>
> ------------------------------
> *From:* Bruno Rijsman <brunorijsman@gmail.com>
> *Sent:* Monday, April 22, 2019 4:16 PM
> *To:* rift@ietf.org
> *Subject:* Initial implementation of security in RIFT-Python is complete
>
> I have finished the initial implementation of security in
> RIFT-Python (security envelope, keys, fingerprints, nonces, packet-nr, etc.
> etc.)
>
> See http://bit.ly/rift-python-security-feature-guide
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__bit.ly_rift-2Dpython-2Dsecurity-2Dfeature-2Dguide&d=DwMCAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=maKXfKzgRTpiLitqHnJiww&m=htkOLD_Mz6ekfr_iYDTC5Q7xzPbroaycphOlQuwgDAg&s=t-P4E1fGgdJ6fiTwi2uXPbhcMxKse2r47pppAq8EO_I&e=> for
> a detailed feature guide.
>
> While implementing the code, I gathered a number of comments on the
> security section of the draft -05. I will report these in a follow-up
> e-mail.
>
> -- Bruno
> _______________________________________________
> RIFT mailing list
> RIFT@ietf.org
> https://www.ietf.org/mailman/listinfo/rift
>